Compliance Frameworks

Compliance at Its Best:
See what customers have to say about The anecdotes Compliance OS

SOC 2. HIPAA. ISO. PFL. BLT.

Those last two are made up, but we had you sweating, right? Point is, your Compliance program is way more than the alphabet soup of certifications and reports. But you still need them, so The anecdotes Compliance OS is here to make it easier by providing a more direct, customized path to the specific certifications you need.

Cross Mapping

Why do the same thing twice? With The anecdotes Compliance OS your work from existing frameworks is leveraged to achieve more Compliance milestones. Your evidence is automatically linked to relevant controls across various frameworks so that you can easily grow your Compliance program.

“We started with SOC 2 and are now using the platform for ISO, which has been made much easier thanks to the cross mapping of evidence.”

Unified Control View

Already built a framework tailored to your organization’s needs? Want to build one? No problem! With The anecdotes Compliance OS you can power your custom framework with data and automation to continue to mature your Compliance posture.

“It's easy to navigate and look at the process from different views, such as all evidence collected or the list of required controls and their status.”

Custom Framework

Give your organization a bird’s eye view of your Compliance posture, based on business units, and not only frameworks. You can utilize overlap of controls and requirements across the frameworks, reducing the number of duplicating controls and thus, time spent on manually managing hundreds of controls.

“The best thing about Anecdotes is... The support to upload your own common control framework for a more savvy compliance program.”

ISO 27017

ISO/IEC 27017:2015 is the code of practice for cloud service customers and providers wishing to incorporate their cloud security into the ISMS (for certified ISO 27001 organizations).

CSA STAR

Cloud Security Alliance (CSA) Security, Trust, Assurance and Risk (STAR) is a security-centric framework that allows cloud service providers (CSPs) to attest to, or be audited against, a cloud control matrix (CCM), which is now in its 4th iteration.

ISO 22301

ISO 22301 specifies requirements to implement, maintain and improve a business continuity management system to protect against, reduce the likelihood of the occurrence of, prepare for, respond to, and recover from disruptions when they arise.

ISO-IEC 27001:2022

Specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system within the context of the organization.

ISO-IEC 27018

ISO/IEC 27018:2019 is a common set of security categories and controls that can be implemented by a public cloud computing service provider acting as a PII processor, wishing to incorporate it into the ISMS (for certified ISO 27001 organizations).

CSA CoC - GDPR

Cloud Security Alliance (CSA) Code of Conduct is a privacy-centric framework that allows cloud service providers (CSPs) to attest to, or be audited against, a Code of Conduct for achieving GDPR compliance (when combined with a minimum security baseline, such as the CSA STAR).

SCF - EU GDPR

Secure Controls Framework (SCF) EU GDPR Compliance Criteria (EGCC) provides a “paint by numbers” approach to complying with GDPR, since GDPR is leveraging work you should already have done through your existing cybersecurity and privacy program.

NIST 800-171

Aims to protect controlled unclassified information (CUI) in non-federal systems and organizations.

NIST CSF

NIST Cybersecurity Framework (CSF) is a high-level framework aiming to assist organizations in managing cybersecurity risk. It can be implemented in a customizable manner.

NYDFS Part 500

The New York State Department of Financial Services published Cybersecurity Regulation (commonly known as Part 500) that applies to organizations operating under the Banking Law, the Insurance Law, or the Financial Services Law (considered "covered entities").

TISAX ISA

The Information Security Assessment (ISA) is an information security requirements catalog based on key aspects of the international standard ISO/IEC 27001. It is used by companies both for internal purposes as well as assessments by suppliers and service providers who process sensitive information from their respective companies.

PCI-DSS SAQ A-EP

PCI DSS Self-Assessment for 'Partially Outsourced E-commerce Merchants Using a Third-Party Website for Payment Processing'.

PCI-DSS SAQ A

PCI DSS Self-Assessment for 'Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced'.

Open Finance DSS

OFDSS establishes a common framework for consumer data security, privacy, and control that also supports innovation among new and emerging cloud-native, digital finance companies.

CIS v8

The CIS Critical Security Controls (CIS Controls) are a prioritized set of Safeguards to mitigate the most prevalent cyber-attacks against systems and networks.